Cache-Control: no-store

RFC 9111 §5.2.2.5 Cache-Control: no-store middleware for paths that serve operator-individualized content (account pages, transactional pages, API responses with PII, auth-gated routes). Sets Cache-Control: no-store + Pragma: no-cache (HTTP/1.0 compatibility) + Vary: Cookie, Authorization so intermediate caches don't store a personalized response keyed by URL alone.

Per the 2026-05-11 audit's web-browser hardening gap: many primitives (b.middleware.requireAuth etc.) already set no-store on the 401 refuse path, but operator routes serving AUTHENTICATED content lacked a centralized no-store middleware. This is it.

Compose with b.middleware.requireAuth for the standard auth-gated shape:

app.use("/account", b.middleware.requireAuth()); app.use("/account", b.middleware.noCache());

Or use the predicate form to apply only when the route matches an operator-supplied test:

app.use(b.middleware.noCache({ when: function (req) { return req.url.indexOf("/api/private/") === 0; }, }));

b.middleware.noCache(opts?) #

{
  when:    function (req) → boolean,   // optional — only set headers when truthy
  cacheControl: string,                 // override "no-store" (e.g. "no-store, private")
  vary:    string,                      // override the Vary header (default "Cookie, Authorization")
  skipExisting: boolean,                // default false — when true, skip when Cache-Control is already set
}

Build the no-cache middleware. With no opts, applies to every request: sets Cache-Control: no-store, Pragma: no-cache, Vary: Cookie, Authorization. Pass opts.when(req) for a conditional path predicate.

app.use("/account", b.middleware.requireAuth(), b.middleware.noCache());

// Conditional — only for the API subtree
app.use(b.middleware.noCache({
  when: function (req) { return req.url.indexOf("/api/private/") === 0; },
}));

Last updated 2026-08-08T16:39:49.652Z by seeder.